A reported hack of AI music company Suno has raised fresh questions about how it built its music-generation system and whether it may have unlawfully gathered training data. According to 404 Media, a hacker accessed Suno’s systems and found source code that allegedly showed large-scale scraping from YouTube Music and other platforms, which matters because Suno is already defending its use of copyrighted material under fair use while facing legal pressure from major record labels.

The report says the hacker used a supply-chain attack to obtain an employee’s credentials, then accessed code indicating scraping from YouTube Music, Deezer, Genius, stock music libraries and podcast RSS feeds over many years. Suno has previously said it trains on “publicly available music files” from the open internet, but record labels argue that bypassing YouTube’s anti-scraping protections would breach the DMCA and YouTube’s terms of service; rival Udio has faced similar accusations. The hacker also reportedly accessed customer emails, phone numbers and partial Stripe card details, and Suno said the November 2025 breach was limited, quickly contained and not disclosed to customers.